chore: sync from template v1.2.45

---

name: Lint

"on":

  pull_request:

    branches:

      - main

  schedule:

    # Run on the 10th of each month at noon.

    - cron: "00 12 10 * *"

  workflow_dispatch:

concurrency:

  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}

  cancel-in-progress: true

jobs:

  test:

    name: lint

    runs-on: ubuntu-latest

    permissions:

      contents: read

    continue-on-error: ${{ matrix.experimental }}

    strategy:

      fail-fast: true

      matrix:

        python: ["3.10", "3.x"]

        ansible: ["9", "latest"]

        experimental: [false]

        include:

          - python: "3.x"

            ansible: "9"

            experimental: true

        exclude:

          - python: "3.x"

            ansible: "9"

            experimental: false

    steps:

      - name: Check out the codebase

        uses: actions/checkout@v5.0.0

      - name: Set up Python

        uses: actions/setup-python@v6.0.0

        with:

          python-version: "${{ matrix.python }}"

          cache: "pip"

          cache-dependency-path: .requirements/${{ matrix.ansible }}.txt

      - name: Install/upgrade pip, wheel

        run: pip install --upgrade pip wheel

      - name: Install test dependencies

        id: deps

        run: pip install -r .requirements/${{ matrix.ansible }}.txt

      - name: Run ansible-lint

        run: ansible-lint

---

name: "Rebase"

"on":

  push:

    branches:

      - main

concurrency:

  group: push-rebase-main

  cancel-in-progress: true

jobs:

  rebase:

    name: "Rebase"

    runs-on: ubuntu-latest

    permissions:

      pull-requests: write

      contents: write

    steps:

      - name: "Rebase all non-draft non-dependencies pull requests"

        uses: peter-evans/rebase@v3.1.0

        with:

          base: main

          exclude-drafts: true

          exclude-labels: dependencies

---

name: Release

"on":

  push:

    branches:

      - main

jobs:

  release:

    name: "Release"

    runs-on: ubuntu-latest

    permissions:

      pull-requests: write

      contents: write

    concurrency:

      group: semantic-release

      cancel-in-progress: false

    steps:

      - name: Checkout

        uses: actions/checkout@v5

        with:

          fetch-depth: 0

          token: ${{ secrets.SEMANTIC_RELEASE_TOKEN || secrets.GITHUB_TOKEN }}

      - name: Semantic release

        run: |

          docker run --rm \

            --user 1001 \

            -v ${{ github.workspace }}:/workspace \

            -w /workspace \

            -e GITHUB_TOKEN=${{ secrets.SEMANTIC_RELEASE_TOKEN || secrets.GITHUB_TOKEN }} \

            -e CI=true \

            ghcr.io/disafronov/semantic-release:latest

---

name: Update from template

"on":

  schedule:

    - cron: "00 00 * * *"

  workflow_dispatch:

concurrency:

  group: ${{ github.workflow }}-${{ github.ref }}

  cancel-in-progress: false

jobs:

  merge:

    name: Update from template

    runs-on: ubuntu-latest

    permissions:

      contents: write

    steps:

      - name: Checkout

        uses: actions/checkout@v5.0.0

      - name: Run update script

        run: bash update.sh

      - name: Commit changes back to repository

        uses: EndBug/add-and-commit@v9.1.4

        with:

          commit: --signoff

          default_author: github_actor

          fetch: true

          message: 'ci: update from template'

---

name: Validate

"on":

  pull_request:

    branches:

      - main

jobs:

  validate:

    name: "Validate"

    runs-on: ubuntu-latest

    permissions:

      contents: read

    steps:

      - name: Checkout

        uses: actions/checkout@v5

        with:

          fetch-depth: 0

      - name: Semantic release dry run

        run: |

          docker run --rm \

            --user 1001 \

            -v ${{ github.workspace }}:/workspace \

            -w /workspace \

            ghcr.io/disafronov/semantic-release:latest \

            --dry-run